Does Your AI Provider Train on Your Company Data? Get It in Writing

It depends on the product tier, the contract and the settings, not on the provider's brand. Business and API offerings often state that customer content is not used to train shared models, while consumer products may work differently, so the only reliable answer is the one confirmed in writing for your exact account. Training is also only one of three questions: retention and logging decide just as much about where your data ends up.

Key takeaways

• Training, retention and logging are three separate questions, and a clear answer to one says little about the others.
• The answer depends on account type, plan and settings, so a provider's public reputation is not evidence about your account.
• AI agents add memory, tools and monitoring, and each of those stores company data under its own terms.
• Get answers in writing: contract or data processing terms, evidence of the admin settings, and a named channel for change notices.
• Recheck whenever a plan, a model or an integration changes, because defaults and terms can shift.

What does training on your data actually mean?

Training means the provider uses content you send, such as prompts, uploaded files, model outputs or your feedback, to adjust a model or to build datasets that improve future models. Once information has influenced a model, you cannot retrieve it the way you would delete a file. That is why this question deserves a precise answer before any sensitive material is sent.

Two things are often mistaken for it. The first is fine-tuning that you request: you deliberately adapt a model with your own examples, usually into a private variant. That is training too, but it is a decision you control. The second is retrieval, where the system looks up your documents at answer time and places relevant passages in front of the model. Retrieval does not change the model itself, which is why it is often the safer pattern for company knowledge. The [AWS comparison of retrieval and fine-tuning](https://docs.aws.amazon.com/prescriptive-guidance/latest/retrieval-augmented-generation-options/rag-vs-fine-tuning.html) explains the technical difference clearly.

One more detail: feedback. A thumbs up or a comment attached to a response can be handled under separate terms from ordinary prompts. Ask about it explicitly.

How do training, retention and logging differ?

The three words describe different things, and vendors sometimes answer the one you did not ask.

• Training: whether your content is used to improve models, yours or shared ones.
• Retention: how long your content is stored after the request finishes, where it is stored, and who can access it while it is there.
• Logging: what records are written about each request, by which party, and whether those records contain the full content or only metadata such as time, size and user.

A provider can truthfully say it does not train on your data and still keep prompts for a period, for example to detect abuse or to debug failures. Human reviewers may be able to read flagged content under some terms. Logs can also exist outside the provider: your own application, your agent platform and your monitoring tools may all write full prompts and responses to places with their own retention rules.

So a statement like we do not train on your data answers one question out of three. Treat it as a start, not as a conclusion.

Where else does your data travel besides the model?

A chat window has one data path. A business agent has several. When an agent works for you, content can pass through a retrieval index, a memory store, tool integrations, a message channel, an observability pipeline and one or more model providers. Each of these may involve a different company and a different set of terms.

It helps to list them before asking anyone anything. The exercise in Draw Your AI Stack: A One-Page Architecture Map for Leaders gives you the picture, and the question of geography is covered in AI Data Residency for Business: Where Your Company Data Lives.

Pay particular attention to three places:

• Memory: what the agent remembers between sessions is stored data, and it belongs in your retention rules. Ownership questions are covered in Who Owns Your AI Prompts, Memory and Data? A Company Guide.
• Monitoring and logs: useful for operating the agent, risky if they keep full content with no expiry.
• Subprocessors: the vendors your vendor relies on. Their handling of content is part of your risk even if you never contract with them.

Which answers should you get in writing?

A verbal assurance from a sales call, or a line on a marketing page, can change without notice and binds no one. Ask for the answers in a contract, a data processing agreement, an order form or an official written reply from the vendor, and keep a copy. The broader list of commercial questions is in Questions to Ask an AI Agent Vendor Before You Sign the Contract. For this topic specifically, confirm these:

• Training default: is customer content excluded from training of shared models for this plan, and is that the default or an opt-out you must set?
• Scope of the exclusion: does it cover prompts, files, outputs, embeddings and feedback, or only some of them?
• Fine-tuning: if you fine-tune, who owns the resulting model or adapter, and can the provider reuse it?
• Retention period: how long is content stored, in which regions, and what is the deletion process when you ask?
• Abuse monitoring: is content kept or reviewed for safety purposes, by people or only by automated systems, and can you request an exception?
• Logging: what does the provider log, can you turn content logging off, and what do the logs contain by default?
• Subprocessors: who are they, how are you notified of changes, and can you object?
• Account level: do the terms apply to the exact account type and plan your company uses, including API keys, not only to a different tier?
• Change notice: how will you be told if terms, defaults or data handling change, and to which contact?
• Deletion at exit: what is deleted when the contract ends, and how do you get written confirmation?

Two cautions. First, answers that mention a plan name are tied to that plan, so a later upgrade or downgrade can alter them. Second, watch for the phrase by default. It means the setting may be changeable, by you or by someone else with admin rights, so ask who can change it.

An illustrative scenario: two accounts, two different answers

This is an illustrative scenario, not a real case. A mid-sized services firm wants an agent to summarize customer contracts. Some employees have already been pasting excerpts into a free consumer assistant on their own accounts. Leadership then arranges a company agent that calls a model through a business account.

Asked whether the provider trains on their data, the operations lead hears a reassuring yes, we do not. But the statement applies to the business account. The employees' personal accounts are governed by different terms, and nobody has checked them. Meanwhile the agent platform writes full prompts to its own log store with no expiry, and the memory feature keeps contract summaries indefinitely.

Nothing here required a malicious provider. The gaps came from account types, default log settings and unexamined memory. The fix is procedural: move the work to company-controlled accounts, set an acceptable use rule for personal tools, shorten log and memory retention, and write down the confirmed terms for each component. Adoption matters as much as settings here, which is why How to Get Your Team to Actually Use an AI Agent is worth reading alongside the contract work.

How do you verify the answers instead of only trusting them?

Written commitments are necessary, but they describe intent. Verification shows what your configuration actually does. A practical sequence:

• Step one: inventory every component that touches content, including model providers, retrieval, memory, logging, channels and tools. Note the account and plan used for each.
• Step two: classify the data the agent will handle, such as public, internal, confidential and regulated. Decide which classes may go to which component.
• Step three: collect written terms for each component and record the date you received them and the contact who confirmed them.
• Step four: capture the settings. Screenshots or exported configuration from the admin console show what is switched on, and who holds admin rights.
• Step five: test with a harmless marker phrase. Send a unique, meaningless phrase, then check where it appears: logs, memory, search indexes, exports. This shows retention and logging in practice.
• Step six: set an expiry for logs and memory that matches your data classes, and schedule a review whenever a plan, a model or an integration changes.

Security reviewers will want this evidence, and the process in How to Run a Security Review of an AI Agent Provider fits around it. For a broader frame, the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) helps structure ownership and review, and the [OWASP Top 10 for LLM Applications](https://genai.owasp.org/llm-top-10/) lists sensitive information disclosure as a risk to design against.

Training policy does not replace your legal duties either. If the agent handles personal data, your obligations under data protection law apply regardless of what the provider promises. For Brazil, the [ANPD](https://www.gov.br/anpd/pt-br) is the authority to consult, and your legal counsel should confirm what applies to you.

How does Be Human handle this in a managed engagement?

Be Human treats data handling as part of the design of each agent role, not as a paperwork step at the end. For every agent, the model providers, tools and memory stores are listed, the account each runs under is identified, and the training, retention and logging terms are confirmed in writing and recorded with the date and source. Content logging and memory retention are set to what the data classes allow, and approval boundaries define which actions and data the agent may touch. In managed operations, these records are rechecked when a provider, plan or integration changes, and permission reviews include the data settings. Be Human documents and monitors the terms your providers publish; it does not rewrite them or promise what a provider will do.

Frequently asked questions

Does using the API mean my data is not used for training? Not automatically, and you should not assume it. Many providers treat API and business plans differently from consumer products, but the specifics depend on the provider, the plan and the settings. Ask for the written term that applies to your account and keep it.

If a provider does not train on my data, is my data safe? Not necessarily. Safe depends on retention, logging, access controls, subprocessors and your own configuration as well. A no-training commitment removes one risk and leaves the others to be confirmed separately.

Can I stop employees from using personal AI accounts for work? You can reduce it, but a ban alone rarely works. Provide a company-approved option that is good enough to use, write a short acceptable use rule that names which data classes may never leave approved tools, and explain the reason. AI Training for Employees: What to Teach Before the Agent Starts covers what to teach.

How often should I recheck these answers? Recheck at each change of plan, model, integration or contract renewal, and on a regular schedule even if nothing seems to have changed. Defaults and subprocessors can shift between reviews. A named owner and a dated entry in your agent inventory keep the check from being forgotten.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.